From d78ebe2a9a3315c7b47f975de7ce2c1657eaa277 Mon Sep 17 00:00:00 2001 From: comis-agent Date: Sun, 26 Jul 2026 12:41:25 +0300 Subject: [PATCH 1/2] test(architecture): guard against a hard-coded patched-provider version in prepack prepack.js logs which patched `@earendil-works/pi-ai` it bundled, and that line is the record used to confirm what a published tarball actually carries. The version was a string literal, so it went stale the moment the pin moved: the script announces 0.80.10 while the workspace pins, patches and bundles 0.82.1. Fails on the current tree naming the literal it found. --- test/architecture/umbrella-bundling.test.ts | 23 +++++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/test/architecture/umbrella-bundling.test.ts b/test/architecture/umbrella-bundling.test.ts index c28bae13f..42e1779d9 100644 --- a/test/architecture/umbrella-bundling.test.ts +++ b/test/architecture/umbrella-bundling.test.ts @@ -158,6 +158,29 @@ describe("umbrella-bundling -- bidirectional 5-way alignment vs bundledDependenc ).toEqual({ referencesBundledDeps: true, hasLiteralArray: false }); }); + // Dimension 1b — prepack.js must not hard-code the patched provider version. + // + // prepack.js bundles the patched `@earendil-works/pi-ai` and logs which + // version it bundled. That log line is the record an operator reads to confirm + // what a published tarball actually carries, so a hard-coded literal is worse + // than useless once the pin moves: it reports a version that is not in the + // tarball. The literal went stale exactly this way when the provider was + // upgraded and prepack.js kept announcing the previous release. + // + // The version must be derived from the bundled package's own manifest. This is + // non-tautological — prepack.js is independent code, and reintroducing any + // `pi-ai@` string literal in it fails here. + it("prepack.js derives the patched provider version (no hard-coded pi-ai version)", () => { + const source = readPrepackSource(); + const hardCoded = [...source.matchAll(/pi-ai@(\d+\.\d+\.\d+)/g)].map((m) => m[0]); + expect( + hardCoded, + "prepack.js must derive the patched @earendil-works/pi-ai version from the bundled " + + "package's manifest (readManifest(patchedProviderSource).version), never a literal — " + + "a literal silently misreports what the published tarball carries once the pin moves.", + ).toEqual([]); + }); + // Dimension 2 — exports map vs canonical source. it("exports map includes every namespaced bundled package (except web)", () => { const pkg = readUmbrellaPackageJson(); From 0341f85c5af2284dfd79e812527c3c79fa67f5b6 Mon Sep 17 00:00:00 2001 From: comis-agent Date: Sun, 26 Jul 2026 12:41:58 +0300 Subject: [PATCH 2/2] fix(release): report the patched provider version prepack actually bundled The bundle step announced a hard-coded `@earendil-works/pi-ai@0.80.10` while the workspace pins, patches and bundles 0.82.1, so the one line an operator reads to confirm what a published tarball carries named a version that is not in it. Derive it from the bundled package's own manifest instead, via the `readManifest` helper this script already uses for the same package three lines earlier. The source path is realpath-resolved through the patched pnpm store entry, so the reported version is the patched copy that ships. --- packages/comis/scripts/prepack.js | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/packages/comis/scripts/prepack.js b/packages/comis/scripts/prepack.js index a25c0908a..1cbddef41 100644 --- a/packages/comis/scripts/prepack.js +++ b/packages/comis/scripts/prepack.js @@ -205,7 +205,11 @@ for (const entry of ["dist", "README.md", "package.json"]) { } cpSync(source, join(patchedProviderDest, entry), { recursive: true }); } -console.log(" bundled patched @earendil-works/pi-ai@0.80.10"); +// Report the version actually bundled. A hard-coded literal here silently goes +// stale on the next provider bump and then misreports what the tarball carries. +console.log( + ` bundled patched @earendil-works/pi-ai@${readManifest(patchedProviderSource).version}`, +); // --- Step 5: Bundle native-dep helpers that npm fails to install --- // npm's reify creates empty directories for transitive deps of non-bundled